Pith. sign in

REVIEW 2 major objections 5 minor 63 references

Signal-Based Malware Classification Using 1D CNNs

T0 review · 2 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that classifying malware binaries as 1D signals instead of 2D byteplot images preserves more information and yields state-of-the-art results on the MalNet dataset.

desk verdict The 1D-signal trick is real and gives a consistent edge over 2D byteplots, but the SOTA claim needs a data-provenance check and a few reporting fixes before I'd trust the headline numbers. read the letter →

arxiv 2509.06548 v2 pith:I3I7M5XI submitted 2025-09-08 cs.CR cs.AIcs.CVcs.LG

Jack Wilkie , Hanan Hindy , Ivan Andonovic , Christos Tachtatzis , Robert Atkinson This is my paper
classification cs.CRcs.AIcs.CVcs.LG
keywords malwareclassification1DCNNbyteplotimagessignalrepresentationLanczosresamplingMalNetdatasetRessqueeze-and-excitation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that malware binaries should be converted into 1D signals rather than 2D byteplot images before being fed to convolutional neural networks. The authors claim that resizing binaries in 1D avoids the heuristic reshaping and integer quantization steps that lose information in byteplot images, and that existing 2D CNN architectures can be adapted to 1D signals by flattening convolution kernels and squaring stride values, keeping parameter count and compute the same. Using this recipe, a 1D ResNet with squeeze-and-excitation layers and GELU activation achieves state-of-the-art F1 scores on the MalNet dataset across binary (0.874), type (0.503), and family (0.507) classification, and 1D versions of common CNNs outperform their 2D counterparts on both Android DEX and Windows EXE malware. The matter matters because it offers a straightforward drop-in replacement for image-based malware classifiers with better downstream accuracy.

What carries the argument

The key machinery is the 1D signal representation of a binary, produced by min-max normalizing bytes to [0,1] floats and resampling with Lanczos resampling to length 65,536, and the kernel-flattening conversion that turns any 2D CNN into a 1D CNN: each k×k kernel becomes a 1×k² kernel and each 2D stride s becomes a 1D stride s², preserving parameter count, receptive field length, and downsampling ratio.

What would settle it

Download the same APK hashes listed in MalNet, extract the DEX bytes, and compare them byte-for-byte (e.g., SHA-256) with those used to render the published byteplots; if any mismatch is found, the state-of-the-art comparison is invalid. Alternatively, train the paper's 1D model and a 2D model with the same improved training recipe and identical hyperparameters on the same data split; if the 2D model matches or exceeds the 1D F1 scores, the information-preservation claim collapses.

Watch

Extended reading notes

Core claim

The central claim is that the information lost when a binary is reshaped into a 2D image and quantized to pixel values is not just noise but useful signal for malware classification; keeping the binary as a 1D floating-point signal preserves that information. The paper shows quantitatively that the combined resizing-plus-quantization noise is lower for signals than images, and that this translates into higher F1 scores for identical network architectures. The 2D-to-1D conversion trick—flattening each 2D kernel into a 1D kernel and squaring the stride—is what makes the comparison apples-to-apples: the adapted 1D model has the same number of parameters and the same compute per forward pass as

Load-bearing premise

The state-of-the-art comparison assumes that the Android DEX files extracted from Androzoo APKs in 2025 are byte-for-byte identical to the binaries that produced the MalNet byteplot images used for the published baselines; no hash check or timestamp verification is reported.

Editorial extensions

If this is right

  • Any existing 2D CNN (ResNet, DenseNet, MobileNet, etc.) can be converted to a 1D signal classifier at zero extra parameter or compute cost and typically higher accuracy.
  • Malware classification pipelines can drop the heuristic reshaping step entirely, eliminating quantization noise and the need for a fixed image width rule.
  • The proposed 1D ResNet with SE and GELU achieves state-of-the-art results on MalNet binary, type, and family classification with a single model family.
  • Signal representations make raw-binary datasets more directly usable, since preprocessing no longer requires generating or storing images.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that the kernel-flattening and stride-squaring recipe is not specific to malware: any 1D time-series or signal task that currently uses 2D CNNs on reshaped or spectrogram inputs could benefit from the same conversion, provided the 1D representation genuinely preserves structure.
  • Because the paper's ablation shows Lanczos resampling beats nearest-neighbor, linear, and cubic filters, byte boundaries likely carry discriminative high-frequency content; a natural extension would be to test learned resampling or wavelet-based representations on the same signal inputs.
  • We infer that the strongest validation of the signal-modality claim would be a controlled experiment where the same 2D and 1D models are trained with the identical improved recipe and verified data provenance on the same splits, isolating the effect of the representation from the training recipe.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes representing malware binaries as 1D signals rather than 2D byteplot images, arguing that this avoids heuristic reshaping and integer quantization. It introduces a pipeline that resizes binaries to 1D floating-point signals via Lanczos resampling, a kernel-flattening/stride-squaring procedure to convert 2D CNNs into parameter- and compute-matched 1D CNNs, and a bespoke ResNetV2-based 1D CNN with squeeze-and-excitation and GELU activations. Experiments on MalNet and the Microsoft Malware Classification dataset compare 1D and 2D models and report state-of-the-art F1 scores on MalNet.

Significance. The central architectural claim is well supported by the internal evidence. Tables 3 and 4 show consistent F1 improvements for 1D variants across six architectures with matched parameter counts and GFLOPs, and Tables 1–2 provide quantitative noise measurements. The kernel-flattening and stride-squaring construction is a clean, deterministic adaptation that preserves parameter/compute budgets. If the MalNet SOTA comparison is verified, the paper offers a simple and potentially impactful alternative to byteplot-based malware classification. The main weaknesses are the unverified data provenance for the MalNet SOTA comparison and the small margins over the prior SOTA, which need strengthening.

major comments (2)
  1. [§4.1, Table 6] The MalNet SOTA comparison assumes that the DEX files extracted from Androzoo APKs downloaded in 2025 are byte-identical to the binaries from which the MalNet byteplot images were generated. Section 4.1 states that file hashes can be used to download the original APKs, but no verification step (e.g., comparing hashes of extracted DEX files, checking APK timestamps/versions, or regenerating byteplot images from the downloaded APKs) is reported. If an APK was updated on Androzoo after MalNet was built, the signal inputs and the image inputs would come from different binaries, invalidating the headline SOTA comparison in Table 6. Please add hash verification or clearly limit the SOTA claim to the subset of samples whose provenance is confirmed. The equal-compute 1D-vs-2D comparison in Tables 3–4 does not depend on this provenance, so the central architectural claim is not affected.
  2. [§4.5, §5.7] The SOTA claim rests on small differences: binary F1 0.874 vs 0.854, type 0.503 vs 0.497, family 0.507 vs 0.491 (Table 6). No confidence intervals, standard deviations, or multiple-seed results are reported, so it is unclear whether these margins are statistically meaningful. The PR-curve analysis in Figure 7 reports AUCs of 0.4983 vs 0.4977 for recall ≥ 0.5; the difference is tiny and should be interpreted cautiously. Please report multiple seeds or statistical tests, and temper the SOTA claim accordingly.
minor comments (5)
  1. [§6] The F1 scores in the final paragraph (0.974, 0.503, 0.503) conflict with the abstract and Table 6 (0.874, 0.503, 0.507). Correct the typo.
  2. [Table 10] The nearest-neighbour row reports Precision as '618' rather than '0.618'. Add the missing decimal.
  3. [§5.1, §5.3] The proposed model uses V2+SE blocks and GELU, but Tables 7 and 9 show V1.5 and ReLU achieving higher F1 on ResNet1D18. The text should justify these design choices (e.g., scaling behaviour or precision) or acknowledge that they were selected for other reasons.
  4. [§4.5] The statement that 'these baselines encompass all models currently benchmarked' is too strong. Please cite a survey or specify the search date to substantiate the SOTA claim.
  5. [§4.3, Tables 1–2] The SNR improvement for signal resizing over image resizing is about 0.7 dB on both datasets. The text calls this 'significantly less noise'; the difference is modest, and a significance test or a more measured phrasing would be appropriate.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the 1D-signal advantage is measured empirically and benchmarked against external models; the MalNet comparison caveat is a data-provenance issue, not circularity.

full rationale

The derivation chain is not circular. The paper's load-bearing claims are: (1) 1D resizing produces less noise than 2D byteplot resizing; (2) flattening 2D kernels and squaring strides preserves parameter count and compute while adapting a model to 1D; (3) with equal parameters and compute, 1D models outperform 2D models; and (4) the proposed ResNet1D model achieves state-of-the-art F1 scores on MalNet. Each claim is checked against external data or direct construction. The noise comparison in Tables 1-2 is a measurement on public binaries, not a fitted parameter. The equal-parameter/compute conversion is an algebraic identity (kernel k×k to kernel k^2; stride s×s to stride s^2) and is then validated by downstream F1 on held-out test data in Tables 3-5. No quantity is defined in terms of the result it is used to predict. The SOTA comparison uses published baselines (ResNet/DenseNet/EfficientNet/SHERLOCK); the only serious weakness is the unverified assumption that Androzoo-downloaded APKs produce the same DEX binaries as MalNet's byteplot images, which is a data-provenance problem, not a circular derivation. I found no load-bearing self-citation, no imported uniqueness theorem, no ansatz smuggled via citation, and no renaming of a known result. The abstract/discussion F1 discrepancy (0.874 vs 0.974) is an internal typo, not evidence of circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests mostly on a data modality assumption (1D Lanczos signals preserve information), a data provenance assumption (Androzoo reconstruction matches MalNet), and the paper's own conversion method. No new physical entities are introduced. The free parameters are standard hyperparameters plus the signal length, which is shown to be suboptimal.

free parameters (4)
  • Signal length (65536) = 65536
    Chosen to match the 256x256 image size for fair comparison with 2D models. Table 11 shows F1 monotonically increases with signal length, so this choice is suboptimal for accuracy.
  • Lanczos resampling parameter 'a' = not stated
    The Lanczos kernel width is not specified in the paper, though it typically defaults to a=3. This affects the resampled signal and is a hand-chosen parameter.
  • Improved training recipe hyperparameters = class balancing 0.5, weight decay 0.005, label smoothing 0.1, 50+10 epochs, LR reduction 10x
    These hyperparameters are chosen by hand to improve validation performance and are not derived from theory. They directly affect the reported SOTA F1 scores.
  • SE bottleneck ratio and GroupNorm groups = not stated
    The squeeze-and-excitation bottleneck size and GroupNorm group count are not given in the paper, so the exact architecture cannot be reproduced from text alone.
assumptions (4)
  • domain assumption Lanczos interpolation of a discrete byte sequence is a meaningful resampling operation for preserving discriminative information.
    The entire pipeline treats byte sequences as continuous signals. The paper shows empirically that this works, but it is an assumption about the data modality and is not derived from properties of binaries.
  • domain assumption The DEX files extracted from Androzoo APKs correspond to the binaries used to generate the MalNet byteplot images.
    Section 4.1 states APKs are downloaded by hash from Androzoo, but no verification step is described. If the APKs were updated after MalNet was created, the comparison to published baselines is invalid.
  • domain assumption The MalNet labels and the predefined 70/10/20 split are reliable and consistent with the baselines cited.
    The paper relies on the public MalNet split and assumes the reported SHERLOCK and other baseline numbers were obtained under the same conditions.
  • ad hoc to paper Flattening a 2D kernel and squaring stride values yields a 1D model with equivalent representational capacity for this task.
    This equivalence is the core methodological claim in Section 3.2. It preserves parameter and compute counts, but whether it preserves the inductive bias relevant to malware classification is an empirical assertion supported only by the paper's experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Signal-Based Malware Classification Using 1D CNNs." pith.science (2026). https://pith.science/paper/I3I7M5XI

@misc{pith2026250906548,
  author       = {Pith},
  title        = {Pith review of: Signal-Based Malware Classification Using 1D CNNs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I3I7M5XI}},
  note         = {Machine review of arXiv:2509.06548}
}
read the original abstract

Malware classification is a contemporary and ongoing challenge in cyber-security: modern obfuscation techniques are able to evade traditional static analysis, while dynamic analysis is too resource intensive to be deployed at a large scale. One prominent line of research addresses these limitations by converting malware binaries into 2D images by heuristically reshaping them into a 2D grid before resizing using Lanczos resampling. These images can then be classified based on their textural information using computer vision approaches. While this approach can detect obfuscated malware more effectively than static analysis, the process of converting files into 2D images results in significant information loss due to both quantisation noise, caused by rounding to integer pixel values, and the introduction of 2D dependencies which do not exist in the original data. This loss of signal limits the classification performance of the downstream model. This work addresses these weaknesses by instead resizing the files into 1D signals which avoids the need for heuristic reshaping, and additionally these signals do not suffer from quantisation noise due to being stored in a floating-point format. It is shown that existing 2D CNN architectures can be readily adapted to classify these 1D signals for improved performance. Furthermore, a bespoke 1D convolutional neural network, based on the ResNet architecture and squeeze-and-excitation layers, was developed to classify these signals and evaluated on the MalNet dataset. It was found to achieve state-of-the-art performance on binary, type, and family level classification with F1 scores of 0.874, 0.503, and 0.507, respectively, paving the way for future models to operate on the proposed signal modality.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

63 extracted references · 34 canonical work pages

  1. [1]

    sn-basic.bst

    FUNCTION identify.basic.version "sn-basic.bst" " [2024/07/19 v1.1 bibliography style]" * top ENTRY address archive author booktitle chapter doi edition editor eid eprint howpublished institution journal key keywords month note number organization pages publisher school series title type url volume year archivePrefix primaryClass adsurl adsnote version lab...

    2024

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION add.period duplicate empty 'skip "." * add.blank if FUNCTION if.digit duplicate "0" = swap duplicate "1" = swap duplicate "2" = swap duplicate "3" = swap duplicate "4" = swap duplicate "5" = swap duplicate "6" = swap duplicate "7" = swap duplicate "8" = swap "9" = or or or or or or or or or FUNCTION ...

  3. [3]

    write newline

    " write newline " cite write " FUNCTION editor.postfix editor num.names #1 > "( )" "( )" if FUNCTION editor.trans.postfix editor num.names #1 > "( )" "( )" if FUNCTION trans.postfix translator num.names #1 > "( )" "( )" if FUNCTION authors.editors.reflist.apa5 'field := 'dot := field num.names 'numnames := numnames 'format.num.names := format.num.names na...

  4. [4]

    write newline

    " write newline "" before.all 'output.state := FUNCTION string.to.integer 't := t text.length 'k := #1 'char.num := t char.num #1 substring 's := s is.num s "." = or char.num k = not and char.num #1 + 'char.num := while char.num #1 - 'char.num := t #1 char.num substring FUNCTION find.integer 't := #0 'int := int not t empty not and t #1 #1 substring 's :=...

  5. [5]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize ":" * " " *...

  6. [6]

    write newline

    " write newline "" before.all 'output.state := FUNCTION output.doi doi empty skip "doi:" doi * "" * output if FUNCTION format.archive archivePrefix empty "" archivePrefix ":" * if FUNCTION format.primaryClass primaryClass empty "" " [" primaryClass * "] " * if FUNCTION format.eprint eprint empty "" archive empty " https://arxiv.org/abs/" eprint * " " * " ...

  7. [7]

    write newline

    " write newline "" before.all 'output.state := FUNCTION string.to.integer 't := t text.length 'k := #1 'char.num := t char.num #1 substring 's := s is.num s "." = or char.num k = not and char.num #1 + 'char.num := while char.num #1 - 'char.num := t #1 char.num substring FUNCTION find.integer 't := #0 'int := int not t empty not and t #1 #1 substring 's :=...

  8. [8]

    sn-aps.bst

    FUNCTION identify.aps.version "sn-aps.bst" " [2024/07/19 v1.1 APS bibliography style]" * top ENTRY address author booktitle chapter doi edition editor eid howpublished institution journal key keywords month note number organization pages publisher school series title type url volume year eprint archive archivePrefix primaryClass adsurl adsnote version lab...

    2024

Show all 63 references
  1. [9]

    write newline

    " write newline "" before.all 'output.state := FUNCTION if.digit duplicate "0" = swap duplicate "1" = swap duplicate "2" = swap duplicate "3" = swap duplicate "4" = swap duplicate "5" = swap duplicate "6" = swap duplicate "7" = swap duplicate "8" = swap "9" = or or or or or or...

  2. [10]

    sn-nature.bst

    FUNCTION identify.nature.version "sn-nature.bst" " [2024/07/19 v1.1 bibliography style]" * top ENTRY address archive author booktitle chapter edition editor eprint howpublished institution journal key keywords month note number organization pages publisher school series title ...

    2024

  3. [11]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  4. [12]

    sn-vancouver-num.bst

    FUNCTION identify.vancouver.version "sn-vancouver-num.bst" " [2024/07/19 v1.1 Vancouver bibliography style]" * top ENTRY address assignee author booktitle chapter cartographer day edition editor howpublished institution inventor journal key keywords month note number organizat...

    2024

  5. [13]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  6. [14]

    A. DK, P. V, Yerima SY, et al (2023) Obfuscated malware detection in iot android applications using markov images and cnn. IEEE Systems Journal 17(2):2756--2766. doi:10.1109/JSYST.2023.3238678

    2023

  7. [15]

    Journal of Information Security and Applications 59:102828

    Abusitta A, Li MQ, Fung BC (2021) Malware classification and composition analysis: A survey of recent developments. Journal of Information Security and Applications 59:102828. doi:https://doi.org/10.1016/j.jisa.2021.102828, ://www.sciencedirect.com/science/article/pii/S2214212...

    2021

  8. [16]

    In: Proceedings of the 13th International Conference on Mining Software Repositories

    Allix K, Bissyand \'e TF, Klein J, et al (2016) Androzoo: Collecting millions of android apps for the research community. In: Proceedings of the 13th International Conference on Mining Software Repositories. ACM, New York, NY, USA, MSR '16, pp 468--471, doi:10.1145/2901739.290...

    2016

  9. [17]

    In: 2018 13th International Conference on Malicious and Unwanted Software (MALWARE), pp 103--111, doi:10.1109/MALWARE.2018.8659358

    Alsulami B, Mancoridis S (2018) Behavioral malware classification using convolutional recurrent neural networks. In: 2018 13th International Conference on Malicious and Unwanted Software (MALWARE), pp 103--111, doi:10.1109/MALWARE.2018.8659358

    2018

  10. [18]

    In: Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence

    Anderson B, Storlie C, Lane T (2012) Improving malware classification: bridging the static/dynamic gap. In: Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence. Association for Computing Machinery, New York, NY, USA, AISec '12, p 3–14, doi:10.1145/23818...

    2012

  11. [19]

    ArXiv e-prints https://arxiv.org/abs/1804.04637 arXiv:1804.04637 [cs.CR]

    Anderson HS, Roth P (2018) EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models . ArXiv e-prints https://arxiv.org/abs/1804.04637 arXiv:1804.04637 [cs.CR]

    2018 arXiv

  12. [20]

    In: 2022 IEEE Symposium on Computers and Communications (ISCC), pp 1--6, doi:10.1109/ISCC55528.2022.9912986

    Bovenzi G, Cerasuolo F, Montieri A, et al (2022) A comparison of machine and deep learning models for detection and classification of android malware traffic. In: 2022 IEEE Symposium on Computers and Communications (ISCC), pp 1--6, doi:10.1109/ISCC55528.2022.9912986

    2022

  13. [21]

    Electronics 11(19):3064

    Chong X, Gao Y, Zhang R, et al (2022) Classification of malware families based on efficient-net and 1d-cnn fusion. Electronics 11(19):3064

    2022

  14. [22]

    In: Goodall JR, Conti G, Ma KL (eds) Visualization for Computer Security

    Conti G, Dean E, Sinda M, et al (2008) Visual reverse engineering of binary and data files. In: Goodall JR, Conti G, Ma KL (eds) Visualization for Computer Security. Springer Berlin Heidelberg, Berlin, Heidelberg, pp 1--17

    2008

  15. [23]

    Digital Investigation 7:S3--S12

    Conti G, Bratus S, Shubina A, et al (2010) Automated mapping of large binary objects using primitive fragment type classification. Digital Investigation 7:S3--S12. doi:https://doi.org/10.1016/j.diin.2010.05.002, ://www.sciencedirect.com/science/article/pii/S1742287610000290, t...

    2010 doi

  16. [24]

    Machine Learning: Science and Technology 4

    Daly G, Fieldsend J, Hassall G, et al (2023) Data-driven plasma modelling: Surrogate collisional radiative models of fluorocarbon plasmas from deep generative autoencoders. Machine Learning: Science and Technology 4. doi:10.1088/2632-2153/aced7f

    2023 doi

  17. [25]

    Electronics 10(4)

    Damasevicius R, Venčkauskas A, Toldinas J, et al (2021) Ensemble-based classification using neural networks and machine learning models for windows pe malware detection. Electronics 10(4). doi:10.3390/electronics10040485, ://www.mdpi.com/2079-9292/10/4/485

    2021 doi

  18. [26]

    pp 138--146, doi:10.1109/COMSNETS53615.2022.9668396

    Deng X, Mirkovic J (2022) Polymorphic malware behavior through network trace analysis. pp 138--146, doi:10.1109/COMSNETS53615.2022.9668396

    2022

  19. [27]

    IEEE Transactions on Network and Service Management 18(2):1165--1177

    Dib M, Torabi S, Bou-Harb E, et al (2021) A multi-dimensional deep learning framework for iot malware classification and family attribution. IEEE Transactions on Network and Service Management 18(2):1165--1177. doi:10.1109/TNSM.2021.3075315

    2021

  20. [28]

    https://arxiv.org/abs/2011.07682 arXiv:2011.07682

    Freitas S, Dong Y, Neil J, et al (2021) A large-scale database for graph representation learning. https://arxiv.org/abs/2011.07682 arXiv:2011.07682

    2021 arXiv

  21. [29]

    ://api.semanticscholar.org/CorpusID:44430018

    Gennissen J, Blasco J (2017) Gamut : Sifting through images to detect android malware. ://api.semanticscholar.org/CorpusID:44430018

    2017

  22. [30]

    Computers & Security 95:101873

    Gibert D, Mateu C, Planes J (2020) Hydra: A multimodal deep learning framework for malware classification. Computers & Security 95:101873. doi:https://doi.org/10.1016/j.cose.2020.101873, ://www.sciencedirect.com/science/article/pii/S0167404820301462

    2020

  23. [31]

    In: 2018 IEEE 14th International Colloquium on Signal Processing & Its Applications (CSPA), pp 99--102, doi:10.1109/CSPA.2018.8368693

    Hasegawa C, Iyatomi H (2018) One-dimensional convolutional neural networks for android malware detection. In: 2018 IEEE 14th International Colloquium on Signal Processing & Its Applications (CSPA), pp 99--102, doi:10.1109/CSPA.2018.8368693

    2018

  24. [32]

    https://arxiv.org/abs/1512.03385 arXiv:1512.03385

    He K, Zhang X, Ren S, et al (2015) Deep residual learning for image recognition. https://arxiv.org/abs/1512.03385 arXiv:1512.03385

    2015 arXiv

  25. [33]

    https://arxiv.org/abs/1603.05027 arXiv:1603.05027

    He K, Zhang X, Ren S, et al (2016) Identity mappings in deep residual networks. https://arxiv.org/abs/1603.05027 arXiv:1603.05027

    2016 arXiv

  26. [34]

    https://arxiv.org/abs/1812.01187 arXiv:1812.01187

    He T, Zhang Z, Zhang H, et al (2018) Bag of tricks for image classification with convolutional neural networks. https://arxiv.org/abs/1812.01187 arXiv:1812.01187

    2018 arXiv

  27. [35]

    https://arxiv.org/abs/1606.08415 arXiv:1606.08415

    Hendrycks D, Gimpel K (2023) Gaussian error linear units (gelus). https://arxiv.org/abs/1606.08415 arXiv:1606.08415

    2023 arXiv

  28. [36]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Hu J, Shen L, Sun G (2018) Squeeze-and-excitation networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  29. [37]

    https://arxiv.org/abs/1705.04448 arXiv:1705.04448

    Huang THD, Kao HY (2018) R2-d2: Color-inspired convolutional neural network (cnn)-based android malware detections. https://arxiv.org/abs/1705.04448 arXiv:1705.04448

    2018 arXiv

  30. [38]

    In: 2018 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS), pp 1--5, doi:10.1109/NTMS.2018.8328749

    Kalash M, Rochan M, Mohammed N, et al (2018) Malware classification with deep convolutional neural networks. In: 2018 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS), pp 1--5, doi:10.1109/NTMS.2018.8328749

    2018

  31. [39]

    IEEE Access 10:5518--5532

    Kim HI, Kang M, Cho SJ, et al (2022) Efficient deep learning network with multi-streams for android malware family classification. IEEE Access 10:5518--5532. doi:10.1109/ACCESS.2021.3139334

    2022

  32. [40]

    IEEE Access 11:22889--22903

    Kim J, Paik JY, Cho ES (2023) Attention-based cross-modal cnn using non-disassembled files for malware classification. IEEE Access 11:22889--22903. doi:10.1109/ACCESS.2023.3253770

    2023

  33. [41]

    Frontiers of Information Technology & Electronic Engineering 18(9):1336--1347

    Liu L, Wang Bs, Yu B, et al (2017) Automatic malware classification and new malware detection using machine learning. Frontiers of Information Technology & Electronic Engineering 18(9):1336--1347. doi:10.1631/FITEE.1601325, ://doi.org/10.1631/FITEE.1601325

    2017 doi

  34. [42]

    ://api.semanticscholar.org/CorpusID:22879106

    Llaurad \'o DG (2016) Convolutional neural networks for malware classification. ://api.semanticscholar.org/CorpusID:22879106

    2016

  35. [43]

    IEEE Access 10:95970--95985

    Lu Q, Zhang H, Kinawi H, et al (2022) Self-attentive models for real-time malware classification. IEEE Access 10:95970--95985. doi:10.1109/ACCESS.2022.3202952

    2022

  36. [44]

    In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy

    McLaughlin N, Martinez del Rincon J, Kang B, et al (2017) Deep android malware detection. In: Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy. Association for Computing Machinery, New York, NY, USA, CODASPY '17, p 301–308, doi:10.1145/...

    2017

  37. [45]

    Sensors 22:3094

    Mekruksavanich S, Jitpattanakul A (2022) Deep residual network for smartwatch-based user identification through complex hand movements. Sensors 22:3094. doi:10.3390/s22083094

    2022 doi

  38. [46]

    In: 2014 IEEE Conference on Communications and Network Security, pp 283--291, doi:10.1109/CNS.2014.6997496

    Mohaisen A, West AG, Mankin A, et al (2014) Chatter: Classifying malware families using system event ordering. In: 2014 IEEE Conference on Communications and Network Security, pp 283--291, doi:10.1109/CNS.2014.6997496

    2014

  39. [47]

    In: Proceedings of the 8th International Symposium on Visualization for Cyber Security

    Nataraj L, Karthikeyan S, Jacob G, et al (2011 a ) Malware images: visualization and automatic classification. In: Proceedings of the 8th International Symposium on Visualization for Cyber Security. Association for Computing Machinery, New York, NY, USA, VizSec '11, doi:10.114...

    2011

  40. [48]

    In: Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence

    Nataraj L, Yegneswaran V, Porras P, et al (2011 b ) A comparative assessment of malware classification using binary texture analysis and dynamic analysis. In: Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence. Association for Computing Machinery, New ...

    2011

  41. [49]

    https://arxiv.org/abs/2103.00602 arXiv:2103.00602

    Noever D, Noever SEM (2021) Virus-mnist: A benchmark malware dataset. https://arxiv.org/abs/2103.00602 arXiv:2103.00602

    2021 arXiv

  42. [50]

    Computational Intelligence 38(4):1536--1558

    Paik JY, Jin R, Cho ES (2022) Malware classification using a byte-granularity feature based on structural entropy. Computational Intelligence 38(4):1536--1558. doi:https://doi.org/10.1111/coin.12521, ://onlinelibrary.wiley.com/doi/abs/10.1111/coin.12521, https://arxiv.org/abs/...

    2022 doi

  43. [51]

    In: 2023 5th International Conference on Smart Systems and Inventive Technology (ICSSIT), pp 1042--1049, doi:10.1109/ICSSIT55814.2023.10061076

    Priya V, Sathya Sofia A (2023) Review on malware classification and malware detection using transfer learning approach. In: 2023 5th International Conference on Smart Systems and Inventive Technology (ICSSIT), pp 1042--1049, doi:10.1109/ICSSIT55814.2023.10061076

    2023

  44. [52]

    ://api.semanticscholar.org/CorpusID:21388434

    Rezende ERS, Ruppert GCS, de Carvalho TJ, et al (2018) Malicious software classification using vgg16 deep neural network’s bottleneck features. ://api.semanticscholar.org/CorpusID:21388434

    2018

  45. [53]

    https://arxiv.org/abs/1802.10135 arXiv:1802.10135

    Ronen R, Radu M, Feuerstein C, et al (2018) Microsoft malware classification challenge. https://arxiv.org/abs/1802.10135 arXiv:1802.10135

    2018 arXiv

  46. [54]

    In: 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), pp 561--566, doi:10.1109/IWCMC.2019.8766515

    Safa H, Nassar M, Rahal Al Orabi WA (2019) Benchmarking convolutional and recurrent neural networks for malware classification. In: 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), pp 561--566, doi:10.1109/IWCMC.2019.8766515

    2019

  47. [55]

    pp 336--349, doi:10.1007/978-3-540-70500-0_25

    Sathyanarayan V, Kohli P, Bezawada B (2008) Signature generation and detection of malware families. pp 336--349, doi:10.1007/978-3-540-70500-0_25

    2008 doi

  48. [56]

    International Journal of Network Security & Its Applications (IJNSA) 13(2)

    Schofield M (2021) Comparison of malware classification methods using convolutional neural network based on api call stream. International Journal of Network Security & Its Applications (IJNSA) 13(2). Available at SSRN: https://ssrn.com/abstract=3822934

    2021

  49. [57]

    pp 85--98, doi:10.5121/csit.2021.110106

    Schofield M, Alicioglu G, Binaco R, et al (2021) Convolutional neural network for malware classification based on api call sequence. pp 85--98, doi:10.5121/csit.2021.110106

    2021

  50. [58]

    Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy p 38 – 49

    Schultz MG, Eskin E, Zadok E, et al (2001) Data mining methods for detection of new malicious executables. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy p 38 – 49. ://www.scopus.com/inward/record.uri?eid=2-s2.0-0034838197&partnerID=40&m...

    2001

  51. [60]

    IEEE Access 10:103121–103135

    Seneviratne S, Shariffdeen R, Rasnayaka S, et al (2022 b ) Self-supervised vision transformers for malware detection. IEEE Access 10:103121–103135. doi:10.1109/access.2022.3206445, ://dx.doi.org/10.1109/ACCESS.2022.3206445

    2022

  52. [61]

    In: 29th USENIX Security Symposium (USENIX Security 20)

    Votipka D, Rabin S, Micinski K, et al (2020) An observational investigation of reverse Engineers processes. In: 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, pp 1875--1892, ://www.usenix.org/conference/usenixsecurity20/presentation/votipka-observational

    2020

  53. [62]

    Computer Modeling in Engineering & Sciences 130:1003--1016

    Wang L, Sun J, Luo X, et al (2021) Transferable features from 1d-convolutional network for industrial malware classification. Computer Modeling in Engineering & Sciences 130:1003--1016. doi:10.32604/cmes.2022.018492

    2021

  54. [63]

    Security and Communication Networks 2022:2957203

    Yeboah PN, Musah HBB (2022) Nlp technique for malware detection using 1d cnn fusion model. Security and Communication Networks 2022:2957203. doi:10.1155/2022/2957203, ://doi.org/10.1155/2022/2957203

    2022 doi

  55. [64]

    International Journal of Information Security 22(6):1687--1712

    Zyout M, Shatnawi R, Najadat H (2023) Malware classification approaches utilizing binary and text encoding of permissions. International Journal of Information Security 22(6):1687--1712. doi:10.1007/s10207-023-00712-z, ://doi.org/10.1007/s10207-023-00712-z

    2023 doi

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.